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DETAILED ACTION 
Drawings 

New corrected drawings in compliance with 37 CFR 1.121(d) are required in this 
application because they are informal. Applicant is advised to employ the services of a 
competent patent draftsperson outside the Office, as the U.S. Patent and Trademark Office no 
longer prepares new drawings. The corrected drawings are required in reply to the Office action 
to avoid abandonment of the application. The requirement for corrected drawings will not be 
held in abeyance. 

The drawings are further objected to under 37 CFR 1.83(a). The drawings must show 
every feature of the invention specified in the claims. For example, claim 22 includes a pre- 
clustering step which is not depicted in either of the figures submitted. Furthermore, that claim 
also comprises the step of tracking each time the user retrieves and reads a document outside of 
the most frequently accessed clusters, where this limitation also must be shown or the feature(s) 
canceled from the claim(s). The examples given are not meant as a comprehensive list of all 
limitations mentions throughout the claims and not depicted in the figures. Examiner requests 
that Applicants review the limitations of each of the claims to ensure that each of the claimed 
limitations are depicted in the figures. No new matter should be entered. 

Corrected drawing sheets in compliance with 37 CFR 1.121(d) are required in reply to 
the Office action to avoid abandonment of the application. Any amended replacement drawing 
sheet should include all of the figures appearing on the immediate prior version of the sheet, 
even if only one figure is being amended. The figure or figure number of an amended drawing 
should not be labeled as "amended " If a drawing figure is to be canceled, the appropriate figure 
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must be removed from the replacement sheet, and where necessary, the remaining figures must 
be renumbered and appropriate changes made to the brief description of the several views of the 
drawings for consistency. Additional replacement sheets may be necessary to show the 
renumbering of the remaining figures. Each drawing sheet submitted after the filing date of an 
application must be labeled in the top margin as either "Replacement Sheet" or "New Sheet" 
pursuant to 37 CFR 1.121(d). If the changes are not accepted by the examiner, the applicant will 
be notified and informed of any required corrective action in the next Office action. The 
objection to the drawings will not be held in abeyance. 

Claim Rejections - 35 USC § 103 

I. The following is a quotation of 35 U.S. C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

II. Claims 1-2, 7, and 14 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Lermuzeaux et al., US Patent No. 5,621,889 and further in view of Oblinger, US Pub No. 
2002/0107852. 

As per claim 1 : 

Lermuzeaux et al. substantially teach a method comprising: a) constructing a user cluster 
index for a user of a digital data gathering system (col. 7, lines 9-25); b) monitoring families of 
the digital data gathering results of the user (col. 4, lines 9-67); c) comparing the families of the 
digital data gathering results of the user to the user cluster index to determine anomalies in the 



Application/Control Number: 09/929,094 Page 4 

Art Unit: 2137 

digital data gathering results (col. 3, line 41 - col. 4, line 2); and d) identifying a potential misuse 
when an anomaly is detected (col. 3, lines 30-41). 

Not explicitly disclosed is wherein the user cluster index comprises a list of families of 
data to which data from digital data gathering results of the user were categorized. However, 
Oblinger teaches a system of clustering data based on certain domains that the user wishes to 
search in context of. Therefore, it would have been obvious to a person in the art at the time the 
invention was made to modify the method disclosed in Lermuzeaux et al. to construct a user 
cluster index where the cluster index comprises a list of families of data that are gathered 
together based on the user's history. This modification would have been obvious because a 
person having ordinary skill in the art, at the time the invention was made, would have been 
motivated to do so since Oblinger suggests the use of an information retrieval system that is 
organized in such a way that allows a more precise search based on the context chosen and thus 
has great benefits as shown in paragraphs 32 and 79 of Oblinger. 
As per claim 2: 

Lermuzeaux et al. and Oblinger substantially teach the method according to claim 1. 
Furthermore, Lermuzeaux et al. teach the method further comprising: a) comparing the 
anomalies to the user cluster index to determine the ratio of anomalies to existing clusters; and b) 
reporting a potential misuse when the ratio exceeds a predetermined threshold (col. 4, lines 36- 
43). 

As per claim 7: 

Lermuzeaux et al. and Oblinger substantially teach the method according to claim 1 . 
Furthermore, Lermuzeaux et al. teach the method further comprising: a) constructing a structured 
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data profile for a user of a digital data gathering system (col. 8, lines 3-15); b) wherein the 
structured data profile comprises a list of data identifying workplace characteristics of the user 
(col. 8, lines 3-50); c) comparing the digital data gathering results of the user to the structured 
data profile to determine whether the digital data gathering results are congruent with the 
structured data profile (col. 8, lines 3-50); and d) identifying a potential misuse when the digital 
data gathering results are not congruent with the structured data profile (col. 8, lines 3-50). 
As per claim 14: 

Lermuzeaux et al. substantially teach a method comprising: a) constructing a structured 
data profile for a user of a digital data gathering system (col. 7, lines 19-25); c) monitoring 
digital data gathering results of the user (col. 8, lines 43-50); d) comparing digital data gathering 
results of the user to the structured data profile to determine whether the digital data gathering 
results are congruent with the structured data profile (col. 8, lines 43-50); and e) identifying a 
potential misuse when the digital data gathering results are not congruent with the structured data 
profile (col. 10, lines 32-40). 

Not explicitly disclosed is b) wherein the structured data profile comprises a list of data 
identifying workplace characteristics of the user. However, Oblinger teaches a system of 
clustering data based on certain domains that the user wishes to search in context of. Therefore, 
it would have been obvious to a person in the art at the time the invention was made to modify 
the method disclosed in Lermuzeaux et al. for the structured data profile to comprise a list of data 
identifying workplace characteristics of the user. This modification would have been obvious 
because a person having ordinary skill in the art, at the time the invention was made, would have 
been motivated to do so since Oblinger suggests the use of an information retrieval system that is 
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organized in such a way that allows a more precise search based on the context chosen and thus 
has great benefits in paragraphs 32 and 79. 

III. Claims 3-6 and 9 are rejected under 35 U.S.C 103(a) as being unpatentable over 
Lermuzeaux et al, US Patent No. 5,621,889 and Oblinger, US Pub No. 2002/0107852 further in 
view of Lane et al., Temporal Sequence Learning and Data Reduction for Anomaly Detection. 
As per claim 3: 

Lermuzeaux et al. and Oblinger substantially teach the method according to claim 1. 
Furthermore, Lermuzeaux et al. teach the method further comprising: a) monitoring digital data 
gathering results of the user (col. 4, lines 9-67). Not explicitly disclosed is wherein b) 
constructing a user lexicon for a user of a digital data gathering system wherein the user lexicon 
comprises a list of words or phrases gathered from documents of the digital data gathering results 
of the user. However, Lane et al. teach that based on the user's past queries, a dictionary is 
created with the most-likely commands/terms used historically by that user. Therefore, it would 
have been obvious to a person in the art at the time the invention was made to modify the method 
disclosed in Lermuzeaux et al. for the profile to include a user lexicon of user terms. This 
modification would have been obvious because a person having ordinary skill in the art, at the 
time the invention was made, would have been motivated to do so since Lane et al. suggests that 
similarities in the user's current behavior when typing commands/queries and the accumulated 
history of the user's behavior are a strong indication of normal usage in section 2.2 (found on 
pages 300-301). 

Also not explicitly disclosed is c) comparing words or phrases gathered from the 
documents of the digital data gathering results to the user lexicon to determine anomalies in the 
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digital data gathering results; and d) identifying a potential misuse when an anomaly is detected. 
However, Lane et al. teach that based on the user's past queries, a dictionary is created with the 
most-likely commands/terms used and that an anomaly can be detected when the user behavior is 
determined to be anything other than normal. Therefore, it would have been obvious to a person 
in the art at the time the invention was made to modify the method disclosed in Lermuzeaux et 
al. to compare the results of the user to the user profile to determine anomalies from the new 
queries/results and to identify a potential misuse when detecting an anomaly. This modification 
would have been obvious because a person having ordinary skill in the art, at the time the 
invention was made, would have been motivated to do so since Lane et al. suggests that 
similarities in the user's current behavior when typing commands/queries and the accumulated 
history of the user's behavior are a strong indication of normal usage in section 2.2 (found on 
pages 300-301). 
As per claim 4: 

Lermuzeaux et al., Oblinger, and Lane et al. substantially teach the method according to 
claim 3. Furthermore, Lane et al. teach the method further comprising: a) monitoring digital data 
gathering queries of the user; b) and wherein the user lexicon further comprises a list of words or 
phrases gathered from the monitoring of the queries; c) comparing queries of the user to the user 
lexicon to determine anomalies in the queries and d) identifying a potential misuse when an 
anomaly is detected (sec. 2.2, pages 300-301). 
As per claim 5: 

Lermuzeaux et al., Oblinger, and Lane et al. substantially teach the method according to 
claim 3. Furthermore, Lane et al. teach the method further comprising: a) determining a ratio of 
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anomalies to words or phrases in the lexicon; and b) reporting a potential misuse when the ratio 
exceeds a predetermined threshold (sec. 2.2.1-2.2.2 on pages 301-302). 
As per claim 6: 

Lermuzeaux et al., Oblinger, and Lane et al. substantially teach the method according to 
claim 3. Furthermore, Lane et al. teach wherein the user lexicon comprises a list of words or 
word strings identifying particular words or types of words, or both, extracted from documents 
returned in response to user queries (sec. 2.2, pages 300-301). 
As per claim 9: 

Lermuzeaux et al., Oblinger, and Lane et al. substantially teach the method according to 
claim 3. Furthermore, Lermuzeaux et al. teach the method further comprising: a) constructing a 
structured data profile for a user of a digital data gathering system (col. 8, lines 3-15); b) wherein 
the structured data profile comprises a list of data identifying workplace characteristics of the 
user (col. 8, lines 3-50); c) comparing the digital data gathering results of the user to the 
structured data profile to determine whether the digital data gathering results are congruent with 
the structured data profile (col. 8, lines 3-50); and d) identifying a potential misuse when the 
digital data gathering results are not congruent with the structured data profile (col. 8, lines 3- 
50). 

IV. Claim 8 is rejected under 35 U.S.C. 103(a) as being unpatentable over Lermuzeaux et al, 
US Patent No. 5,621,889 and Oblinger, US Pub No. 2002/0107852 and further in view of Parker 
et al., US Patent No. 5,909,589. 
As per claim 8: 
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Lermuzeaux et al. and Oblinger substantially teach the method according to claim 7. Not 
explicitly disclosed is the method further comprising: a) the structured data profile comprising a 
structured data profile lexicon of terms and phrases indicating valid user activity; and b) 
identifying a potential misuse when the digital data gathering results are not congruent with the 
structured data profile. However, Parker et al. teach that several questions and responses that 
would be easily known to the student are stored in order to validate the user and creating an 
alarm when the words entered by the user are not identical to those stored by the valid user. 

Therefore, it would have been obvious to a person in the art at the time the invention was 
made to modify the method disclosed in Lermuzeaux et al. to include a structured data profile 
with a lexicon of terms/phrases which can indicate valid user activity and to identify a potential 
misuse when the expected results are not received. This modification would have been obvious 
because a person having ordinary skill in the art, at the time the invention was made, would have 
been motivated to do so since Parker et al. suggest registering student information to be able to 
differentiate between valid and invalid users in col. 9, lines 17-30 and col. 1 1, lines 16-55. 
V. Claims 10-12 are rejected under 35 U.S.C 103(a) as being unpatentable over Parker et 
al, US Patent No. 5,909,589 and further in view of Lane et al., Temporal Sequence Learning and 
Data Reduction for Anomaly Detection, 
As per claim 10: 

Parker et al. substantially teach a method comprising: a) monitoring digital data gathering 
results of the user (col. 1 1, lines 16-44); b) constructing a user lexicon for a user of a digital data 
gathering system (col. 9, lines 22-30); c) comparing words or phrases gathered from the 
documents of the digital data gathering results to the user lexicon to determine anomalies in the 
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digital data gathering results (col. 1 1, lines 16-44); and d) identifying a potential misuse when an 
anomaly is detected (col. 1 1, lines 45-55). 

Not explicitly disclosed is wherein the user lexicon comprises a list of words or phrases 
gathered from documents of the digital data gathering results of the user. However, Lane et al. 
teach that based on the user's past queries, a dictionary is created with the most-likely 
commands/terms used historically by that user. Therefore, it would have been obvious to a 
person in the art at the time the invention was made to modify the method disclosed in Parker et 
al. for the profile to include a user lexicon of user terms. This modification would have been 
obvious because a person having ordinary skill in the art, at the time the invention was made, 
would have been motivated to do so since Lane et al. suggests that similarities in the user's 
current behavior when typing commands/queries and the accumulated history of the user's 
behavior are a strong indication of normal usage on page 298, par. 2. 
As per claim 1 1 : 

Parker et al. and Lane et al. substantially teach the method according to claim 10. 
Furthermore, Lane et al. teach the method further comprising: a) determining a ratio of 
anomalies to words or phrases in the lexicon; and b) reporting a potential misuse when the ratio 
exceeds a predetermined threshold (sec. 2.2.1-2.2.2 on pages 301-302). 
As per claim 12: 

Parker et al. and Lane et al. substantially teach the method according to claim 10. 
Furthermore, Lane et al. teach wherein the user lexicon comprises a list of words or word strings 
identifying nouns extracted from documents returned in response to user queries on page 298, 
par. 2. 
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VI. Claim 13 is rejected under 35 U.S.C. 103(a) as being unpatentable over Parker et al., US 
Patent No. 5,909,589 and Lane et al., Temporal Sequence Learning and Data Reduction for 
Anomaly Detection and further in view of Lermuzeaux et al., US Patent No. 5,621,889. 
As per claim 13: 

Parker et al. and Lane et al. substantially teach the method according to claim 10. Not 
explicitly disclosed is the method further comprising: a) constructing a structured data profile for 
a user of a digital data gathering system; b) wherein the structured data profile comprises a list of 
data identifying workplace characteristics of the user; c) comparing the digital data gathering 
results of the user to the structured data profile to determine whether the digital data gathering 
results are congruent with the structured data profile; and d) identifying a potential misuse when 
the digital data gathering results are not congruent with the structured data profile. 

However, Lermuzeaux et al. teach the method further comprising: a) constructing a 
structured data profile for a user of a digital data gathering system (col. 8, lines 3-15); b) wherein 
the structured data profile comprises a list of data identifying workplace characteristics of the 
user (col. 8, lines 3-50); c) comparing the digital data gathering results of the user to the 
structured data profile to determine whether the digital data gathering results are congruent with 
the structured data profile (col. 8, lines 3-50); and d) identifying a potential misuse when the 
digital data gathering results are not congruent with the structured data profile (col. 8, lines 3- 
50). 

Therefore, it would have been obvious to a person in the art at the time the invention was 
made to modify the method disclosed in Lermuzeaux et al. to incorporate attributes such as for 
workplace characteristics and to use the profile created from a user's history to evaluate normal 
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usage among users. This modification would have been obvious because a person having 
ordinary skill in the art, at the time the invention was made, would have been motivated to do so 
since Lermuzeaux suggests that it's known to monitor user behavior over time in order to detect 
intrusions in col. 1, lines 39-47. 

VII. Claims 15-21 are rejected under 35 U.S.C. 103(a) as being unpatentable over 

Lermuzeaux et al., US Patent No. 5,621,889 and further in view of Oblinger, US Pub No. 

2002/0107852 Lane et al., Temporal Sequence Learning and Data Reduction for Anomaly 

Detection. 

As per claim 15: 

Lermuzeaux et al. substantially teach a method comprising: b) the profile including a 
structured data profile of known user characteristics (col. 7, lines 19-25); c) monitoring 
information retrieval results of the user (col. 4, lines 9-67); f) comparing the information retrieval 
results of the user to the structured data profile to determine whether the results are congruent 
with the structured data profile (col. 8, lines 43-50); and g) identifying a potential misuse when 
the information retrieval results are not congruent with the structured data profile (col. 10, lines 
32-40). 

Not explicitly disclosed is a) constructing a profile of use for a user of an information 
retrieval system. However, Oblinger teaches a system of clustering data based on certain 
domains that the user wishes to search in context of Therefore, it would have been obvious to a 
person in the art at the time the invention was made to modify the method disclosed in 
Lermuzeaux et al. for the structured data profile to comprise a list of data identifying workplace 
characteristics of the user. This modification would have been obvious because a person having 
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ordinary skill in the art, at the time the invention was made, would have been motivated to do so 
since Oblinger suggests the use of an information retrieval system that is organized in such a way 
that allows a more precise search based on the context chosen and thus has great benefits in 
paragraphs 32 and 79. 

Also not explicitly disclosed is b) the profile including a user cluster index of result 
document categories. However, Oblinger teaches a system of clustering data based on certain 
domains that the user wishes to search in context of Therefore, it would have been obvious to a 
person in the art at the time the invention was made to modify the method disclosed in 
Lermuzeaux et al. to construct a user cluster index where the cluster index comprises a list of 
families of data that are gathered together based on the user's history. This modification would 
have been obvious because a person having ordinary skill in the art, at the time the invention was 
made, would have been motivated to do so since Oblinger suggests the use of an information 
retrieval system that is organized in such a way that allows a more precise search based on the 
context chosen and thus has great benefits in paragraphs 32 and 79. 

Also not explicitly disclosed is b) the profile including a user lexicon of user terms. 
However, Lane et al. teach that based on the user's past queries, a dictionary is created with the 
most-likely commands/terms used historically by that user. Therefore, it would have been 
obvious to a person in the art at the time the invention was made to modify the method disclosed 
in Lermuzeaux et al. for the profile to include a user lexicon of user terms. This modification 
would have been obvious because a person having ordinary skill in the art, at the time the 
invention was made, would have been motivated to do so since Lane et al. suggests that 
similarities in the user's current behavior when typing commands/queries and the accumulated 
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history of the user's behavior are a strong indication of normal usage in section on page 298, par. 
2. 

Finally not explicitly disclosed is d) comparing the information retrieval results of the 
user to the user profile to determine the anomalies in the new queries and results and e) 
identifying a potential misuse when an anomaly is detected. However, Lane et al. teach that 
based on the user's past queries, a dictionary is created with the most-likely commands/terms 
used and that an anomaly can be detected when the user behavior is determined to be anything 
other than normal. Therefore, it would have been obvious to a person in the art at the time the 
invention was made to modify the method disclosed in Lermuzeaux et al. to compare the results 
of the user to the user profile to determine anomalies from the new queries/results and to identify 
a potential misuse when detecting an anomaly. This modification would have been obvious 
because a person having ordinary skill in the art, at the time the invention was made, would have 
been motivated to do so since Lane et al. suggests that similarities in the user's current behavior 
when typing commands/queries and the accumulated history of the user's behavior are a strong 
indication of normal usage in section 2.2 (found on pages 300-301). 
As per claim 16: 

Lermuzeaux et al, Oblinger, and Lane et al. substantially teach the method according to 
claim 15. Furthermore, Lane et al. teach the method further comprising: a) determining a ratio of 
anomalies to words or phrases in the lexicon; and b) reporting a potential misuse when the ratio 
exceeds a predetermined threshold (sec. 2.2.1-2.2.2 on pages 301-302). 
As per claim 17: 
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Lermuzeaux et al., Oblinger, and Lane et al. substantially teach the method according to 
claim 15. Furthermore, Lane et al. teach the method further comprising: weighting potential 
misuses identified from the user lexicon, the user cluster index, and the structured data profile to 
determine a report of potential misuse (sec. 2.2.2, page 302, par. 1). 
As per claim 18: 

Lermuzeaux et al., Oblinger, and Lane et al. substantially teach the method according to 
claim 15. Furthermore, Lermuzeaux et al. teach the method further comprising: sending a 
notification of potential misuse when a potential misuse is identified from two or more of the 
user lexicon, the user cluster index, and the structured data profile (col. 5, line 61 - col. 6, line 8). 
As per claim 19: 

Lermuzeaux et al., Oblinger, and Lane et al. substantially teach the method according to 
claim 15. Furthermore, Lane et al. teach wherein the user lexicon comprises a list of words or 
phrases gathered from metadata of documents returned in the query results (sec. 2.2, pages 300- 
301). 

As per claim 20: 

Lermuzeaux et al., Oblinger, and Lane et al. substantially teach the method according to 
claim 15. Furthermore, Lane et al. teach the user lexicon comprises a list of words, or types of 
words, or both, extracted from documents returned in the query results (sec. 2.2, pages 300-301). 
As per claim 21: 

Lermuzeaux et al., Oblinger, and Lane et al. substantially teach the method according to 
claim 15. Furthermore, Oblinger teaches wherein the user cluster index comprises a list of 
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families of data to which the data of the user information retrieval results have been categorized 
(par. 32 and 79). 

VIII. Claim 22 is rejected under 35 U.S.C. 103(a) as being unpatentable over Herz et al., US 
Patent No. 5,835,087 and further in view of Lane et al., Temporal Sequence Learning and Data 
Reduction for Anomaly Detection. 
As per claim 22: 

Herz et al. substantially teach a method comprising the steps of: a) pre-clustering the 
document collection (col. 4, line 35 - col. 5, line 6); b) tracking the cluster from which any 
document read by the user originates (col. 5, lines 7-20); c) building up a profile of the user 
based on most frequently accessed clusters over a time sufficient to establish a confidence 
threshold for validity of the profile of the user (col. 68, lines 63-67); and d) tracking each time 
the user retrieves and reads a document outside of the most frequently accessed clusters (col. 7, 
lines 11-45). 

Not explicitly disclosed is e) establishing a misuse threshold number for documents read 
outside of the most frequently accessed clusters and after the misuse threshold number is 
obtained, signaling that a potential misuse may have occurred. However, Lane et al. teach that 
based on the user's past queries, a dictionary is created with the most-likely commands/terms 
used and that an anomaly can be detected when the user behavior is determined to be anything 
other than normal. Therefore, it would have been obvious to a person in the art at the time the 
invention was made to modify the method disclosed in Herz et al. to establish a threshold 
indicating a misuse has occurred when enough documents that are not in the cluster of the most 
frequently accessed documents are accessed and to identify a potential misuse when detecting an 
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anomaly. This modification would have been obvious because a person having ordinary skill in 
the art, at the time the invention was made, would have been motivated to do so since Lane et al. 
suggests that similarities in the user's current behavior and the accumulated history of the user's 
behavior are a strong indication of normal usage in section 2.2 (found on pages 300-301). 
IX. Claim 23 is rejected under 35 U.S.C. 103(a) as being unpatentable over Lane et al., 
Temporal Sequence Learning and Data Reduction for Anomaly Detection and further in view of 
Zhang et al., US Patent No. 5,832,182. 
As per claim 23: 

Lane et al. substantially teach a method comprising the steps of: a) retrieving documents 
in response to user queries (sec. 2.2.1 on page 301); b) clustering the retrieved documents by 
category (sec. 2.2.2 on pages 301-303); and d) determining if a sufficient number of retrieved 
documents do not participate in any valid cluster and if not, sounding an alarm (sec. 2.2.3 - 2.2.4 
on pages 303-304). 

Not explicitly disclosed is c) establishing and obtaining a threshold number of retrieved 
documents and after the threshold number of retrieved documents is obtained, determining a size 
for each clusters, and further denoting clusters of a large enough size as valid clusters. However, 
Zhang et al. teach keeping track of cluster sizes so that one cluster does not become excessively 
large. Therefore, it would have been obvious to a person in the art at the time the invention was 
made to modify the method disclosed in Lane et al. to monitor the number of documents 
retrieved so that once a threshold number of them are retrieved determining if the size is valid. 
This modification would have been obvious because a person having ordinary skill in the art, at 
the time the invention was made, would have been motivated to do so since Zhang et al. suggest 
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that the data is clustered in the correct cluster and not clustered where it does not belong in col. 
19, lines 5-16 and col. 19, lines 46-52. 

X. Claims 24-25 are rejected under 35 U.S.C. 103(a) as being unpatentable over Lane et al., 
Temporal Sequence Learning and Data Reduction for Anomaly Detection and further in view of 
Herz et al., US Patent No. 5,835,087. 
As per claim 24: 

Lane et al. substantially teach a method comprising the steps of: a) identifying top 
weighted terms from documents retrieved by the user and storing the top weighted terms in a 
user-specific lexicon (sec. 2.2.1 on page 301); c) identifying for each new query, if the top 
weighted terms are in the user-specific lexicon (sec. 2.2.2 on pages 301-303); d) tracking a ratio 
of newly occurring terms to existing user-specific lexicon terms (sec. 2.2.2 on pages 301-303); 
and e) if the ratio of newly occurring terms to existing user-specific lexicon terms exceeds a 
threshold, sending an alarm (sec. 2.2.3 - 2.2.4 on pages 303-304). 

Not explicitly disclosed is b) tracking user activity until the rate of new terms added 
slows and the user-specific lexicon stabilizes to form a user profile. However, Herz et al. teach 
monitoring users' search queries and an updating the profile in order to maintain a relevant 
profile. Therefore, it would have been obvious to a person in the art at the time the invention was 
made to modify the method disclosed in Lane et al. to track user activity until the rate of new 
terms added slows and the user-specific lexicon stabilizes to form a user profile. This 
modification would have been obvious because a person having ordinary skill in the art, at the 
time the invention was made, would have been motivated to do so since Herz et al. suggests that 
it is important to maintain an updated user search profile in order to avoid long exhaustive 
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searches by implementation of this system in col. 1, lines 45-49 and col. 4, line 35 - col. 5, line 
30. 

As per claim 25: 

Lane et al. and Herz et al. substantially teach the method according to claim 24. 
Furthermore, Herz et al. teach the method, further comprising the steps of: a) tagging the 
documents to identify words in the documents by type (col. 12, lines 47-67); b) running an 
original query of terms and phrases (col. 12, lines 6-46); c) selecting specific types of words 
from relevant documents retrieved by the original query and adding these terms to a second 
query (col. 12, line 47 - col. 13, line 23); and d) iteratively selecting specific types of words from 
relevant documents retrieved by each query and adding the selected specific types of words to a 
further query to filter the user-specific lexicon (col. 13, line 24 - col. 14, line 2). 
XI. Claim 26 is rejected under 35 U.S.C. 103(a) as being unpatentable over Oblinger, US Pub 
No. 2002/0107852 and further in view of Lane et al., Temporal Sequence Learning and Data 
Reduction for Anomaly Detection. 
As per claim 26: 

Oblinger substantially teaches a method, comprising the steps of: a) identifying structured 
data sources that can be used to identify what the user is working on (par. 49 and par. 60, lines 1- 
9) and b) querying these sources and, for each source, mapping a structured result into a 
structured data lexicon of terms and phrases that indicate valid user activity (par. 60, lines 9-20). 
Not explicitly disclosed is c) for each new query, tracking a ratio of terms found in the structured 
data lexicon to those not found in the structured data lexicon; and d) if the ratio exceeds a 
threshold, sending an alarm that a misuse may have occurred. 
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However, Lane et al. teach that a similarity function is used in order to determine a ratio 
of terms that occur in the user's dictionary and those that don't thereby determining an anomaly 
if the similarity value is not high enough. Therefore, it would have been obvious to a person in 
the art at the time the invention was made to modify the method disclosed in Oblinger to track a 
ratio of terms found in the structured data lexicon to those not found in the structured data 
lexicon and to send an alarm that a misuse may have occurred if a certain threshold is exceeded. 
This modification would have been obvious because a person having ordinary skill in the art, at 
the time the invention was made, would have been motivated to do so since Lane et al. suggests 
that similarities in the user's current behavior when typing commands/queries and the 
accumulated history of the user' s behavior are a strong indication of normal usage in section 2.2 
(found on pages 300-301). 

XII. Claim 27 is rejected under 35 U.S.C. 103(a) as being unpatentable over Oblinger, US Pub 
No. 2002/0107852 and further in view of Herz et al., US Patent No. 5,835,087 and Lane et al., 
Temporal Sequence Learning and Data Reduction for Anomaly Detection. 
As per claim 27: 

Oblinger et al. substantially teach a method, comprising the steps of: a) identifying 
structured data sources that can be used to identify what the user is working on (par. 49 and par. 
60, lines 1-9); and b) querying the identified structured data sources and, for each source queried, 
mapping a structured result into a structured data lexicon of terms and phrases that indicate valid 
user activity (par. 60, lines 9-20). 

Not explicitly disclosed is c) for each new query, retrieving relevant documents for that 
new query and d) extracting key terms from the relevant documents. However, Herz et al. teach 
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retrieving relevant documents based on the queries entered and updating the user's search history 
by maintaining the most relevant terms. Therefore, it would have been obvious to a person in the 
art at the time the invention was made to modify the method disclosed in Oblinger to retrieve 
relevant documents for each new query and extracting the key terms from the relevant 
documents. This modification would have been obvious because a person having ordinary skill 
in the art, at the time the invention was made, would have been motivated to do so since Herz et 
al. suggest that updating the profile is important in order to ensure that the user is retrieving the 
most relevant data in the most time-efficient manner, in col. 5, lines 7-40 and col. 6, lines 1-18. 

Not explicitly disclosed is e) identifying the ratio of key retrieved terms found in the 
lexicon to those not found in the lexicon; and f) if the ratio exceeds a threshold, sending an alarm 
that a misuse may have occurred. However, Lane et al. teach that a similarity function is used in 
order to determine a ratio of terms that occur in the user's dictionary and those that don't thereby 
determining an anomaly if the similarity value is not high enough. Therefore, it would have been 
obvious to a person in the art at the time the invention was made to modify the method disclosed 
in Oblinger to identify a ratio of terms found in the structured data lexicon to those not found in 
the structured data lexicon and to send an alarm that a misuse may have occurred if a certain 
threshold is exceeded. This modification would have been obvious because a person having 
ordinary skill in the art, at the time the invention was made, would have been motivated to do so 
since Lane et al. suggests that similarities in the user's current behavior when typing 
commands/queries and the accumulated history of the user's behavior are a strong indication of 
normal usage in section 2.2 (found on pages 300-301). 
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^References Cited, Not Used 

The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. 

1. US Patent No. 6,370,525 

2. US Patent No. 6,594,654 

3. US Patent No. 6,446,035 

4. US Pub. No. 2002/0042793 

The above references have been cited because they are relevant due to the manner in which the 
invention has been claimed. 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Nadia Khoshnoodi whose telephone number is (571) 272-3825. 
The examiner can normally be reached on M-F: 8:00-4:30. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Emmanuel Moise can be reached on (571) 272-3865. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 
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Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 
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